[AZ-197] Remove hardware ID binding from resource flow

Sealed-Jetson + SaaS architecture eliminates the credential-reuse-across-
machines threat that motivated hardware fingerprint binding. The binding's
only remaining effect was a real production failure mode on legitimate
hardware events.

Production:
- Drop PUT /users/hardware/set and POST /resources/check.
- Simplify POST /resources/get/{dataFolder?} (no Hardware field).
- Remove CheckHardwareHash, UpdateHardware, Security.GetHWHash.
- GetApiEncryptionKey signature: (email, password) — no hardwareHash.
- Drop SetHWRequest DTO and Hardware property from GetResourceRequest.
- Remove HardwareIdMismatch (40) and BadHardware (45) ExceptionEnum
  entries; numeric codes left as a gap, not for reuse.

Wire-compat policy: drop entirely (no Loader; no in-flight legacy
clients). Stale callers will see 404s, which is the right loud failure.

Tombstones:
- User.Hardware DB column kept (nullable, unused) — separate cleanup
  ticket for the migration per workspace "no rename without confirmation".
- User.LastLogin is now never written by app code (only writer was inside
  the deleted CheckHardwareHash); flagged in batch_06_review for a future
  ticket.

Tests:
- Delete e2e HardwareBindingTests (165 lines) and Azaion.Test
  UserServiceTest (sole test was CheckHardwareHashTest).
- Drop Hardware payloads + /resources/check preconditions from e2e
  ResourceTests, SecurityTests, ResilienceTests; drop hardwareId arg
  from Azaion.Test SecurityTest.
- Add SecurityTests.Hardware_endpoints_are_removed_AZ_197 (AC-2 regression
  asserting both removed routes return 404).

Docs:
- architecture.md: System Context note, ADR-003 new key formula, ADR-004
  retired with rationale.
- diagrams/flows/flow_hardware_check.md: tombstoned.

Also archives the four batch-1+batch-2 task files into _docs/02_tasks/done/
(file moves were missed by the batch_05 commit).

Code review: PASS — see _docs/03_implementation/reviews/batch_06_review.md.

Co-authored-by: Cursor <cursoragent@cursor.com>

Azaion.AdminApi/Program.cs

@@ -172,12 +172,6 @@ app.MapGet("/users",
     .RequireAuthorization(apiAdminPolicy)
     .WithSummary("List users by criteria");
 
-app.MapPut("/users/hardware/set",
-        async ([FromBody]SetHWRequest request, IUserService userService, ICache cache, CancellationToken ct) =>
-        await userService.UpdateHardware(request.Email, request.Hardware, ct: ct))
-    .RequireAuthorization(apiAdminPolicy)
-    .WithSummary("Sets user's hardware");
-
 app.MapPut("/users/queue-offsets/set",
         async ([FromBody]SetUserQueueOffsetsRequest request, IUserService userService, CancellationToken ct)
             => await userService.UpdateQueueOffsets(request.Email, request.Offsets, ct))
@@ -229,20 +223,18 @@ app.MapPost("/resources/clear/{dataFolder?}",
 
 app.MapPost("/resources/get/{dataFolder?}", //Need to have POST method for secure password
     async ([FromBody]GetResourceRequest request, [FromRoute]string? dataFolder, IAuthService authService,
-        IUserService userService, IResourcesService resourcesService, CancellationToken ct) =>
+        IResourcesService resourcesService, CancellationToken ct) =>
     {
         var user = await authService.GetCurrentUser();
         if (user == null)
             throw new UnauthorizedAccessException();
 
-        var hwHash = await userService.CheckHardwareHash(user, request.Hardware);
-
-        var key = Security.GetApiEncryptionKey(user.Email, request.Password, hwHash);
+        var key = Security.GetApiEncryptionKey(user.Email, request.Password);
         var stream = await resourcesService.GetEncryptedResource(dataFolder, request.FileName, key, ct);
 
         return Results.File(stream, "application/octet-stream", request.FileName);
     }).RequireAuthorization()
-    .WithSummary("Gets encrypted by users Password and HardwareHash resources. POST method for secure password");
+    .WithSummary("Gets encrypted by user's Password resource. POST method for secure password");
 
 app.MapGet("/resources/get-installer",
         async (IAuthService authService, IResourcesService resourcesService, CancellationToken ct) =>
@@ -271,16 +263,6 @@ app.MapGet("/resources/get-installer/stage",
     .WithSummary("Gets latest installer");
 
 
-app.MapPost("/resources/check",
-    async (CheckResourceRequest request, IAuthService authService, IUserService userService) =>
-    {
-        var user = await authService.GetCurrentUser();
-        if (user == null)
-            throw new UnauthorizedAccessException();
-        await userService.CheckHardwareHash(user, request.Hardware);
-        return true;
-    });
-
 app.MapPost("/classes",
     async (CreateDetectionClassRequest request, IValidator<CreateDetectionClassRequest> validator,
         IDetectionClassService detectionClassService, CancellationToken ct) =>